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OFFICE OF THE UNDER SECRETARY OF DEFENSE 
WASHINGTON, D.C. 20301 

November 1, 1979 


U-S 79-038 


POLICY 


statintl 

^Omel^mformatToi^ervices Staff 
Central Intelligence Agency 
Washington, D.C. 20505 

Dear Tom: 

Attached for your information is a copy of the GAO Report, "Con- 
tinuing Problems in DoD's Classification of National Security 
Information, " dated October 26, 1979. 

It is my understanding from Tim Ingram of the Preyer Committee 
Staff that the Committee will hold a hearing on November 13, 1979 
(time and place unknown). The purpose of this hearing will be to 
consider the GAO recommendations. I further understand that after 
hearing GAO witnesses, the Committee will decide whether to 
pursue hearings on E. O. 12065. 



Arthur F. Van Cook 

Director of Information Security 

Attachment 
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BY THE COMPTROLLER GENERAL 

Report To The Congress 

OF THE UNITED STATES 


Continuing Problems In DOD’s 
Classification Of National Security 
Information 


Some individuals at DOD did not comply 
with the provisions of the 1978 Exec- 
utive order and DOD's regulation on the 
classification of national security infor- 
mation. As a result, there was improper 
use of classification authority, improper 
classification of information, and defi- 
ciencies in the marking of classified in- 
formation. 

To correct these conditions, DOD should 
expand the training given to classifiers 
and improve its independent inspections 
of classification activities. 

This report was prepared at the request 
of two congressional committees. 
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COMPTROLLER GENERAL OF THE UNITED STATES 

WASHINGTON, D.C. 20548 


B-179296 


To the President of the Senate and the 
Speaker of the House of Representatives 

This report describes the results of our review of 
classified documents at 23 military installations and offices 
in the continental United States, Hawaii, Europe, and the 
Canal Zone. It is the second in a series of reports on the 
classification of national security information. Our first 
report, "Improved Executive Branch Oversight Needed for the 
Government's National Security Information Classification 
Program,” was issued March 9, 1979. 

We are sending copies of this report to the Director, 
Office of Management and Budget; the Administrator of 
General Services; and the Secretary of Defense. 

2L 

Comptroller General 
of the United States 
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COMPTROLLER GENERAL'S CONTINUING PROBLEMS IN DOD' S 

REPORT TO THE CONGRESS CLASSIFICATION OF NATIONAL 

SECURITY INFORMATION 

DIGEST 

The Department of Defense (DOD) has con- 
tinuing problems with its national security 
information classification program. They 
include 

— improper use of classification authority, 

— improper classification of information, 
and 

— deficiencies in marking classified 
information. 

GAO found such problems with 49 percent of 
the documents it reviewed at 23 DOD instal- 
lations and offices in the continental 
United States, Hawaii, Europe, and the 
Canal Zone. 

IMPROPER USE OF 
CLASSIFICATION AUTHORITY 

Executive Order 12065, which governs the 
classification program, specifies the 
individuals authorized to originally clas- 
sify information, when that authority may 
be delegated, and individuals authorized 
to classify information for periods longer 
than the normal 6 years. GAO found that 

— information was originally classified by 
individuals who were not authorized clas- 
sifiers; 

— individuals with top secret classification 
authority improperly delegated authority 
to subordinates to extend classification 
for more than 6 years? and 

— sections of some classification guides did 
not specify the level of classification 
to be used in classifying information on a 
derivative basis which, in effect, allows 
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unauthorized individuals to make original 
classification decisions. (See p. 5.) 

IMPROPER CLASSIF ICAT ION 
OF INFORMATION 

Of 556 documents reviewed by GAO, 133, or 
about 24 percent, contained information 
that had been improperly classified. GAO 
found that 

— information not related to national secu- 
rity was classified; 

— references to classified documents that 
did not disclose classified information 
were classified; 

— contrary to the order, when there was 
doubt as to the level of classification 
to be used, the more restrictive classi- 
fication was used; 

— the same information was classified in- 
consistently; and 

— information that had lost some of its 
sensitivity was not downgraded. (See 

p. 12. ) 

DEFICIENCIES IN MARKING 
CLASSIFIED INFORMAT ION 

Despite the fact that the current order 
and implementing instructions, as did 
the previous order that was in effect 
from 1972 to 1978, clearly specify the 
markings that are to be shown on each 
classified document, improper marking 
continues to be a problem for DOD. 

Overall, GAO identified one or more marking 
errors on 33 percent of the documents it 
reviewed. The major marking deficiencies 
were that classified documents did not show 
the 

— original classification authority or 
office of origin; 


ii 


Approved For Release 2002/01/24 : CIA-RDP85B00236R0002001 3001 4-4 



Approved For Release 2002/01/24 : CIA-RDP85B00236R0002001 3001 4-4 


— date or event for declassification or 
review or the reason for classifying 
information for more than the standard 
6-year period; and 

— portions of information that were clas- 
sified and unclassified. (See p. 19.) 

The order requires that documents be portion 
marked so that the level of classification 
of information can be easily ascertained. 

GAO believes that, at least in the case of 
DOD, portion marking should also be used to 
identify specific information that requires 
protection for more than 6 years. Such 
markings would make some information avail- 
able to the public at an earlier date and 
would facilitate the review and declassifi- 
cation of other information at a later date. 
(See p. 22. ) 

IMPROVED TRAINING AND 
INSPECTIONS NEEDED 

Improved training and inspections are needed 
to reduce deficiencies in DOD' s classifica- 
tion program. 

Most classifiers told GAO that their 
training had generally consisted of orien- 
tation briefings for newly hired' or trans- 
ferred staff; periodic security briefings; 
and memorandums, newsletters, posters, and 
other security-awareness type publications. 
Training generally focused on physical 
safeguards and proper marking of informa- 
tion, rather than proper classification. 

Similarly, inspections seldom, if ever, in- 
cluded an evaluation of whether information 
had been properly classified. As with 
training, inspections generally focused on 
physical safeguards and proper marking of 
information. Most classifiers indicated 
that GAO's review was the first time they 
had been asked by an independent party to 
justify their classification decisions. 
Neither the order nor the implementing 
instructions contain requirements or 
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guidance concerning the frequency or the 
types of inspections that are to be made. 

(See p. 25 . ) 

RECOMMENDATIONS 

The Secretary of Defense should revise DOD's 
information security program regulation to: 

— Require all classification guides and in- 
structions and revisions to be reviewed 
during periodic independent classification 
inspections. Unresolved deviations from 
the order and regulation should be brought 
to the attention of the Director of Infor- 
mation Security to assure prompt resolution. 

— Require classified documents to be portion 
marked to identify information that re- 
quires protection for more than 6 years. 

— Provide expanded training for individuals 
who classify information, originally or 
derivatively, to concentrate on, among 
other things (1) their responsibility to 
comply with the order and instructions, 

(2) who can classify information, (3) what 
information is to be classified, and 
(4) how to properly classify and mark 
information. 

— Provide definitive guidance on the fre- 
quency of different levels of inspections 
that should be made and the items to be 
covered, with special reference to the 
need to question the propriety of clas- 
sification decisions. 

AGENCY COMMENTS 

DOD believes that the errors described in 
the report were generally minor in nature 
and were the result of classifiers being 
unfamiliar with requirements of the new 
Executive order. DOD said that the re- 
ported discrepancies do not convey nor 
support a premise of noncompliance with 
the order, but do underscore the continu- 
ing need for management support for edu- 
cation and training efforts. 
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In commenting on GAO's recommendations, 
DOD said that it would consider having 
unresolved classification guide problems 
brought to the attention of the Director 
of Information Security for resolution, 
and providing guidance on the minimum 
frequency for security inspections and 
areas to be covered. DOD did not agree 
that classified documents should be 
marked to identify the portions that 
require protection for more than 6 years 
or that its regulation be revised to 
provide for expanded training. GAO still 
believes its recommendations concerning 
training and portion marking material 
requiring protection for longer than 
6 years have merit. GAO believes its 
findings clearly demonstrate the need for 
expanded training, and portion marking 
would facilitate declassification at an 
earlier date. (See app. I and pp. 11, 

18, 24, and 29. ) 
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CHAPT ER 1 
INTRO DUCTI ON 

This review was requested by the Chairmen, Subcommittee 
on Priorities and Economy in Government, Joint Economic Com- 
mittee, and the Subcommittee on Government Information and 
Individual Rights, House Committee on Government Operations. 

The classification of national security information has 
been governed by various Executive orders since 1940. Imple 
mentation of the classification program is governed by Execu 
tive Order 12065, which took effect December 1, 1978. It 
superseded Executive Order 11652 which was in effect from 
June 1972 through November 1978. Both orders provide for 
three levels of classification — top secret, secret, and con- 
fidential — depending on the degree of sensitivity of the 
information to national security. 

The previous order required the use of a general declas 
sification schedule of 6 to 10 years for the automatic down- 
grading and eventual declassification of information, 
depending on its level of classification. The new order 
abolishes the general declassification schedule and limits 
the classification of most information to 6 years. It fur- 
ther provides that information requiring protection for a 
longer period can be classified for up to 20 years. Infor- 
mation constituting permanently valuable records of the Gov- 
ernment must be reviewed for declassification at the end of 
20 years, but classification can be extended for additional 
10-year periods, provided the information, is reviewed at the 
end of each 10 years. Foreign government information may be 
classified for up to 30 years. 

The previous order allowed material to be exempted for 
30 years before requiring a declassification review, and 
classification beyond that period could be extended indefi- 
nitely at the discretion of the head of the agency origi- 
nating the document. Both orders provide that the exemption 
privilege be exercised only by an individual with the 
authority to originally classify top secret information and 
that it be used sparingly, consistent with national security 
interests. 

The National Security Council was responsible for moni- 
toring implementation of the previous order. An Interagency 
Classification Review Committee, composed of representatives 
from various Government agencies, assisted the Council. The 
Committee was responsible for ensuring compliance with the 
order and implementing directives issued by the President 
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through the Council. The new order makes the Administrator 
of General Services responsible for implementing and moni- 
toring the program, and it directs him to delegate that 
responsibility to an Information Security Oversight Office. 

Although the Department of Defense (DOD) has been using 
classification guides for many years, the new order is the 
first to specifically authorize their use. A classification 
guide should specify the level and duration of classification 
for specific types of information for a weapon system, proj- 
ect, or subject. 

The classification of information is divided into two 
categories — original and derivative. An original classifi- 
cation is an initial determination that information, m the 
interests of national security, requires a specific degree 
or level of protection against unauthorized disclosure. A 
derivative classification occurs when classified information 
is extracted or summarized from one document for use in 
another. In other words, the classification assigned to the 
latter document is derived from the classification status of 
the former. Executive Order 12065 expands the use of deriva- 
tive classification to include information that is classified 
based on directions included in an approved classification 
guide. Classification guides have to be approved in writing 
by the head of the agency or by an official with top secret 
classification authority. 

In both orders the President has designated the heads 
of certain agencies and officials of those agencies to be 
authorized classifiers. Some agency officials have top 
secret authority, while others, depending on their need for 
such authority, have secret or confidential. Both orders 
have attempted to reduce the number of authorized classi- 
fiers on the assumption that such action would reduce the 
number of documents unnecessarily classified. 

DOD classifies more information than any other Govern- 
ment agency. DOD is currently using 1,048 classification 
guides and hundreds of directives, instructions, and 
letters that are used as guides. DOD's information secu- 
rity program is governed by Information Security Program 
Regulation 5200. 1-R, dated December 1978. 

SCOPE OF RE VIE W 

Because of the size of the Government's national secu- 
rity information classification program the review is being 
done in phases. A report (LCD-78-125, Mar. 9, 1979) on the 
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first phase of our review discusses the need for improved 
executive branch oversight of the program. This report on 
the second phase of our review evaluates DOD' s classifica- 
tion activity. 

We visited 23 DOD installations and offices within the 
following organizations in the continental United States, 
Hawaii, Europe, and the Canal Zone: 

— Office of the Secretary of Defense. 

— Office of the Joint Chiefs of Staff. 

- — Department of the Army. 

— Department of the Navy. 

— Department of the Air Force. 

We reviewed Executive Orders 11652 and 12065 and their 
implementing directives and instructions as well as DOD regu- 
lations and instructions relating to security classification 
practices. We also inquired about the development of clas- 
sification guides for specific projects and systems. 

To evaluate DOD's classification program, we selected 
and reviewed 556 top secret, secret, and confidential docu- 
ments for proper classification by comparing the documents 
with the classification guide or the originally classified 
document. On 49 percent of these documents we found one or 
more errors pertaining to improper use of classification 
authority, improper classification of information, and 
improper marking that are described in the following chapters. 
We also discussed the rationale for such classification with 
security managers and classifiers. 

We did not examine any information protected under 
DOD's special access programs. These programs control the 
access, distribution, and protection of particularly sen- 
sitive information. Hundreds of special designations are 
added to top secret, secret, and confidential classification 
markings that further limit access to information because 
special clearances are needed. 

One DOD official said he believed that most top secret 
documents had special access caveats attached. There were 
thousands of classified documents within the intelligence 
field alone that were not subject to our selection for review 
because they also contained special access designations. 
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We did not determine the extent of these special access 
programs and the number of special clearances required to 
gain access to them because, until recently, these programs 
had not been centrally controlled. Executive Order 12065 has 
recognized this problem and has required agencies to estab- 
lish a central control over these programs. At the time of 
our review, DOD had a study underway to comply with this 
requirement. 

Our review of classified documents was hampered by the 
refusal of the Office of the Joint Chiefs Of Staff and the 
Air Force to make certain documents available. DOD stated 
that certain documents that we requested were not made avail- 
able to us because they dealt with Joint Strategic planning, 
and that access to such documents is severely restricted. 

DOD states that documents requested at the Air Force were 
denied to us because they were either originated by or re- 
sponses to the Office of the Joint Chiefs of Staff and the 
Defense Intelligence Agency and could only be released by 
those organizations. Further, DOD does not believe that our 
review was hampered by these restrictions. 

Since these two components did make other documents 
available, we did not pursue the matter. We do not know, 
however, if a review of the withheld documents would have 
disclosed deficiencies different from those found on the 
documents that were furnished. 

Many of the documents denied to us by the Air Force were 
neither originated by nor in response to the Joint Chiefs of 
Staff or the Defense Intelligence Agency; rather, they were 
Air Force documents that merely contained references to docu- 
ments from organizations outside the Air Force. We were told 
that any document created outside the Air Force, no matter 
how routine or mundane the subject area, would not be made 
available to us without approval by the originating agency. 

At one Air Force location visited, officials told us that 
this encompassed most of their documents. 
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CHAPTER 2 

IMPROPER USE OF CLASSIFICATION AUTHORITY 

Executive Order 12065 specifies (1) the DOD officials 
authorized to originally classify information and the cir- 
cumstances when that authority may be delegated, (2) that 
only officials with top secret classification authority can 
classify information for periods longer than 6 years, and 
(3) the types of explicit instructions that should be in- 
cluded in classification guides used by individuals who 
classify information on a derivative basis. Notwithstanding 
the specificity of this guidance, we found that 

— information was originally classified by individuals 
who did not have original classification authority; 

— authority was improperly delegated to individuals 
to extend classification for more than 6 years; and 

— sections of some classification guides did not 
specify the level of classification to be used by 
individuals classifying information on a deriva- 
tive basis, in effect making their classification 
decisions unauthorized original classification 
decisions . 

INFORMATION CLASSIFIED BY 
INDIVIDUALS WHO WERE NOT ~ 

AUTHORIZED CLASSIFIERS 

The order designates the Secretaries of Defense, the 
Army, the Navy, and the Air Force as top secret classifiers 
and permits them to delegate authority to classify informa- 
tion to principal subordinate officials who have a frequent 
need for it. The order also provides that secret and con- 
fidential classification authority may be delegated to sub- 
ordinate officials who have a frequent need for such author- 
ity. DOD' s information security regulation requires that if 
an individual who is not an authorized original classifier, 
originates or develops information that the individual 
believes should be classified, the individual should mark 
the information with the intended classification and transmit 
it to an individual with classification authority for review 
and approval. The previous Executive order and its imple- 
menting instructions, in effect until November 30, 1978, 
contained similar provisions. 
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Of 556 documents reviewed at 7 locations, we identified 
21 documents that were classified by individuals without 
original classification authority. These individuals did 
not have their decisions reviewed by someone with proper 
authority. 

—Thirteen of these documents, classified by individuals 
without original classification authority, were osten- 
sibly classified on a derivative basis citing a clas- 
sification guide or other source document as the clas- 
sification authority. However, the justification for 
each classification decision was not supported by the 
source documents cited as authority. Most individuals 
acknowledged that the derivative classification 
decisions were actually original decisions, even 
though a guide or some other material which discussed 
the subject area was cited. At one location, we were 
told that this was done for eight documents so that 
approval would not have to be obtained from an orig- 
inal classification authority. FOr example, at that 
location a message concerning a shipment of elec- 
tronic equipment was classified confidential and 
a guide was cited as the basis for the classification. 
The individual who classified the message could not 
identify the section of the guide that supported his 
action. He told us that the classification was actu- 
ally based on his own experience. 

— Eight documents cited an individual or organizational 
position rather than a guide or other source material 
as classification authority. These documents were 
classified by individuals without original classifi- 
cation authority and were not reviewed or approved by 
someone with original classification authority. For 
example, one individual, who was not an authorized 
classifier, classified as confidential a report on 
a military exercise and cited his superior officer, 
who was an authorized classifier, as the classifica- 
tion authority. He said that he did not get his 
classification decision reviewed by his superior 
officer because he did not realize that it was 
necessary. 

INDIVIDUALS IMPROPERLY DELEGATED 
AUTHORITY TO EXTEND 
CLASSIFICATION BEYOND 6 YEARS 

The order allows only officials with top secret clas- 
sification authority and certain agency heads to classify 
information for more than 6 years from the date of original 
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classification. The order states that "this authority shall 
be used sparingly. " 

Of the 556 documents we reviewed, we were able to iden- 
tify 524 that had a date for declassification or review. We 
could not identify the declassification or review date on 
the other documents because those markings were missing or we 
did not obtain the cover sheet containing the declassification 
data. Of these 524 documents, 313, or 60 percent, were clas- 
sified for longer than 6 years. 

— In a December 28, 1978, memorandum, an individual 
with top secret authority designated 31 of his 
subordinates (most of whom were geographically 
located elsewhere) to use his position and title 
as classification authority for extending classifi- 
cation beyond 6 years. We obtained a copy of this 
memorandum on April 2, 1979. DOD officials later 
told us that this memorandum was in the process 
of being rescinded at that time. On May 10, 1979, 
the issuing office rescinded the December 1978 memo- 
randum and replaced it with a classification guide. 

The authority to use this guide to extend classifica- 
tion of specific categories of information beyond 
6 years is limited to the same 31 subordinates dele- 
gated authority in the December 28, 1978, memorandum. 
However, the guide is written so that (1) certain 
categories of information are taken almost verbatim 
from DOD' s information security regulation without 
explaining what specifically within those categories 
requires extended protection, (2) only the minimum 
level of classification for categories of information 
is established, leaving the exact designation to the 
judgment of the user, and (3) only the maximum time 
those categories of information can be classified is 
specified, allowing the user to decide the specific 
duration of classification. We brought these defi- 
ciencies in the classification guide to the attention 
of DOD's Information Security Office in June 1979. 

(The problems with guides written in this manner is 
discussed in the following pages.) 

— Another DOD organization specified in writing on 
April 12, 1979, 17 items of information that should 
be classified longer than 6 years. This authoriza- 
tion to extend classification for the specified items 
was delegated to at least 20 individuals within that 
organization. On April 25, 1979, we informed officials 
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of the organization that we believed the delegation 
of authority to extend classification beyond 6 years 
was contrary to the Executive order which prohibits 
the redelegation of original classification authority. 
Officials believed that delegating authority to extend 
classification beyond 6 years was necessary because it 
was unrealistic to expect the, commanding officer (the 
only individual with top secret classification au- 
thority) to review all such documents to determine 
whether to extend classification. On June 21, 1979, 
an official from that organization told us that the 
April 12 memorandum would soon be rescinded and that 
instructions contained in it would fc>s incorporated 
in a classification guide. As of October 1, 1979, 
that guide had not been issued. We do not know if 
use of the guide will be limited to the same individ- 
uals who had been delegated authority to extend clas- 
sification. If use of the guide is not limited to 
those individuals, then anyone using that guide could 
extend classification for more than 6 years and be in 
compliance with the Executive order. Of course, the 
guide must state the reasons why the information has 
to remain classified for more than 6 years and it must 
be approved by the agency head or by an official with 
top secret classification authority, 

CLASSIFICATON GUIDES PERMIT 
ORIGINAL CLASSIFICATION DECISIONS 
BY INDIVIDUALS NOT AUTHORIZED AS 
ORIGINAL CLASSIFI ERS 

Sections of some classification guides permit the users 
to decide the level of classification to be used for specific 
items. Since the majority of individuals who use guides in 
DOD do not have original classification authority, their 
decisions in selecting the appropriate level of classifica- 
tion, in effect, are original classification decisions. 

The new Executive order authorizes the use of classifi- 
cation guides and provides that individuals using them as 
their authority for applying classification markings are 
derivatively classifying national security information, and 
therefore, do not have to be authorized as original classi- 
fiers. The DOD regulation states that guides used to direct 
derivative classification shall specifically identify the 
information to be classified and indicate how the designa- 
tions, time limits, markings, and other requirements of the 
Executive order are to be applied to the information. The 
regulation further provides that classification guides shall 
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state which of the classification designations (i.e., top 
secret, secret, or confidential) applies to the information. 

Implementing instructions issued by the Information 
Security Oversight Office on October 5, 1978,- provide that 
each classification guide is to be k^pt current and is to be 
reviewed at least once every 2 years. The instructions do 
not state who is to make the. review. DOD' s regulation 
requires the originator of the guide to make the review. 

The regulation further provided that all guides issued 
before December 1, 1978, were to be reviewed and updated to 
meet the requirements and provisions of the regulation. 

That review was to be completed before December 1, the 
effective date of the new Executive order. While the 
regulation provides for the distribution of- guides and 
revisions to various DOD offices, it does not require that 
the guides be reviewed by anyone other than the originator. 

Of the 556 documents reviewed, 152, or 27 percent, cited 
guides as the authority for the classification. We examined 
44 guides or portions thereof and found that at 13 locations 
18 guides contained one or more items for which a level of 
classification was not specified. Selecting the proper level 
of classification was left to the discretion of the guides' 
users. For example: 

—One classification guide contained at least three 
different items of information, ranging from un- 
classified to secret, without making it clear which 
level to use. The decision was left to the judgment 
of the user. 

— Another guide that listed 53 different items of 
information provided a choice when 16 of the items 
are classified. For one item of information the 
range was from confidential to top secret. For 
six other items the guide allowed the classifier 
to choose unclassified or confidential. The guide 
instructed the user that "the level of classification 
will depend upon the classifier's judgment of the 
impact of the specific development on national secur- 
ity interests." 

CONCLUSIONS 

The above examples indicate that individuals responsible 
for classifying information believed that administrative con- 
venience was sufficient reason for not complying with the 
explicit requirements of the Executive order and implementing 
instructions . 
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At 7 of the 23 locations visited, some individuals 
originally classified information even though they were not 
authorized to do so. Their actions- as well as those of in- 
dividuals who improperly delegated authority to subordinates 
to extend the classification of information for more than 
6 years, illustrates the need for DOD to emphasize the 
importance of compliance with the requirements pertaining 
to proper use of classification authority. Those require- 
ments were established to preclude overclassification and 
underclassification of information relating to the national 
security. 

Because of the size of DOD's classification program and 
the tremendous volume of information being classfied, we 
realize that it is not possible to entirely eliminate errors 
in judgment; however, we believe that the incidence of such 
errors could be reduced by improved training and independent 
inspections of classification operations. Our recommenda- 
tions covering these points are included in chapter 5. 

The use of classification guides that lack specificity 
and require the users to determine the level of classifica- 
tion to apply to certain items of information is not the 
intent of the Executive order nor DOD's regulation. 

We concur with the provision of the DOD regulation that 
requires the originators of guides to review them at least 
once every 2 years for currency and accuracy, since they 
generally would be the ones most knowledgeable on the subject 
matter of the guides. However, we believe that someone other 
than the originators should also review the guides for com- 
pliance with the provision of the regulation; that is, that 
the level of classification is specified and that classifica- 
tion for longer than 6 years is properly justified. In our 
opinion, such independent reviews should minimize the possi- 
bility of the use of guides that allow original classification 
decisions to be made by individuals who have not been designat- 
ed as original classifiers. 

RE COMMENDATIONS 

We recommend that the Secretary of Defense revise the 
information security program regulation to require that all 
classification guides, instructions, and revisions be reviewed 
during periodic, independent classification inspections to 
assure compliance with the provisions and intent of the 
Executive order and the DOD regulation. We further recommend 
that unresolved deviations from the requirements of the order 
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or the regulation, noted during these independent inspections, 
be brought to the attention of the Director of Information 
Security to assure their prompt resolution. 

DOD COMMENTS AND OUR EVALUATION 


On October 5, 1979, the Deputy Under Secretary of Defense 
commented on our findings and recommendations. (See app. I.) 
In commenting on our finding about the individual with top 
secret classification authority who gave 31 subordinates 
permission to extend classification for more than 6 years 
(see p. 7), DOD states that in July 1979 the Director of 
the Information Security Office requested that the May 1979 
classification guide be revised to overcome its weaknesses. 

The prompt corrective action by the Director is commendable 
and we believe that if his suggestions are properly imple- 
mented, they will correct the guide's deficiencies. As of 
October 1, 1979, however, the Director had not been notified 
that the changes had been put into effect. 

In response to the second example on page 7, DOD believes 
that if the correspondence specifying 17 items of information 
that should remain classified for longer than 6 years was 
signed by an official with top secret classification author- 
ity, "the correspondence was in effect a security classifi- 
cation guide within the meaning of the Executive Order." In 
our opinion, the correspondence cannot be considered a guide 
because it does not meet the criteria established by the 
order or DOD's information security program regulation. The 
correspondence does not specify the level of classification 
applicable to each item of information that requires extended 
protection, the duration of classification for each item, or 
the reasons for the extended protection. 

As noted in DOD's comments, our recommendation has 
undergone minor revision to include classification guides 
and instructions (such as the correspondence described 
above) and to specify when the independent review should be 
made. Although DOD states that a review of classification 
guides by someone other than the originator is already common 
practice, we believe the fact that 18 of the 44 guides that 
we reviewed did not meet the established criteria necessi- 
tates formalizing the independent review requirement in 
DOD's information security program regulation. 
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CHAPTER 3 

IMPROPER CLASSIFICATION OF INFORMATION 


Both Executive orders and the various implementing in- 
structions describe the types of inf oiynat ion that should be 
classified for national security reaso’ns — to preclude over- 
classification and underclassification and to make information 
about the Government available to the maximum extent possible. 
Nevertheless , we identified examples of improperly classified 
information at each DOD installation and office visited. Of 
the 556 documents reviewed, 133, or about 24 percent, con- 
tained one or more examples of improper classification. None 
of these cases involved classified information which was in- 
correctly treated as unclassified. 

The following are some of the more significant problems 
noted . 

— Information not related to national security was 
classified . 

— References to classified documents were classified. 

— The same information was classified inconsistently. 

— Information that lost some of its sensitivity was 
not downgraded. 

— When there was doubt about the level of classifica- 
tion, a higher classification level was assigned. 

INFORMATION NOT RELATED TO 
NATIONAL SECURITY WAS CLASSIFIED 


We identified information in several documents that was 
classified for reasons other than national security. The 
new order prohibits the classification of information unless 
its unauthorized disclosure reasonably could be expected to 
cause at least identifiable damage to the national security. 
The order specifically prohibits classification of informa- 
tion to prevent embarrassment to a person, organization, or 
agency or to restrain competition. 

— A March 1979 message contained a section classified 
confidential which discussed a commanding officer's 
plans to host a small function during a visit to a 
foreign country. Since other sections of the message 
pertaining to the officer's trip, including the ex- 
change of gifts were unclassified, there did not 
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appear to be a valid reason for the above section to 
be classified. The individual who had classified the 
message agreed that the information should not have 
been classified. However, he had received informal 
guidance from his headquarters group that any infor- 
mation on visits by his commander should be classi- 
fied. This section should not have been classified; 
it was promptly declassified shortly after the visit 
was completed. 

— A December 1978 message, classified confidential, 
directed that action not be taken on an earlier, 
unclassified message which discussed joint support 
of a defense project at a military installation. The 
reason for postponing the action was that additional 
study concerning the project was required. The 
December 1978 message was originally classified 
confidential because the classifier believed that 
the reason for postponing the action could cause 
embarrassment to his organization. He agreed that 
the information did not, affect national security 
and should not have been classified and that the 
message should have been marked "For Official Use 
Oniy. " 

— Estimated funding data for a proposed DOD program was 
classified confidential in an operational requirement 
memorandum sent in March 1979. According to the 
classifier, the information was originally classified 
because DOD did not want to release estimated funding 
data for a proposed program. We were told that such 
data might influence contractors' bids -and estimates 
for a contract. The classifier agreed, however, that 
such information, if disclosed would probably not 
damage the national security. 

REFERENCES TO CLASSIFIED 
DOCUME NTS WERE CLASSIFIE D 

Although both orders state that references to classified 
documents that do not disclose classified information should 
not be classified or used as a basis for classification, we 
identified seven documents that were so classified. 

— A January 1979 memorandum was classified because it 
referred to unidentified submarine photographs. The 
letter contained no further detail and the classifier 
agreed that the memorandum should not have been clas- 
sified. As a result of our discussion in March 1979, 
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the classifier stated that action would be taken to 
declassify the letter which was originally scheduled 
for declassification in January 1985. 

— A portion of an April 1979 document was originally 
classified secret because it mentioned a Defense 
Intelligence Agency publication that contained secret 
data. Nothing in the publication was actually dis- 
cussed and the classifier agreed that the reference 
to it should not have been classified. 

— A March 1979 document had a paragraph classified 
secret because it mentioned an appendix that was 
classified secret. Since the title of the appendix 
was not classified and the paragraph made no refer- 
ence to any material in the appendix, the classifier 
agreed that the reference should not have been 
classified . 

THE SAME INFORMATION WA S 
CLASSIFIED INCONSISTENTLY 


One purpose of the implementing instructions to the 
Executive order is to assure that information relating to 
national security is protected on a consistent basis. The 
DOD regulation establishes policies, standards, criteria, 
and procedures for security classification and requires that 
these be uniformly applied. However, we identified several 
instances where the same information was classified at dif- 
ferent levels. 

— DOD issues a recurring, periodic report to the 
Congress on the North Atlantic Treaty Organiza- 
tion's (NATO's) defense posture. The report is 
issued by the Secretary of Defense in three ver- 
sions — secret, unclassified, and NATO secret. Com- 
parison of the secret and unclassified versions of 
the January 1979 report revealed identical pages 
and paragraphs in the unclassified version that were 
classified in the secret version. 

— Two different DOD components originally classified 
the same type data on force mobility — specific quan- 
tities, time, and percentage — at different levels. 

The classifier in one DOD group originally classified 
the data as secret. Subsequently, a secret GAO draft 
report quoted the same type information as part of its 
analysis. However, when the report was sent to another 
DOD group for classification and portion marking, it 
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marked that particular data confidential. The first 
classifier was unable to explain the inconsistency . 

He said that he had classified the data secret because, 
in his opinion, such data is secret. Evidently the 
second DOD group did not believe the information 
merited that classification and, therefore, only 
classified the data as confidential. 

— A July 1978 message derivatively classified similar 
data concerning a particular troop movement in two 
different parts of the message. The information was 
classified confidential in one section and secret in 
the other. The classifier was unable to explain the 
inconsistency. His supervisor said that the informa- 
tion warranted two different levels of classification 
because the confidential data referred to U.S. troop 
movements, while the secret data referred to DOD- 
imposed troop movements. The words " DOD- imposed " 
necessitated a higher classification. The supervisor 
was unable to provide any source material or guidance 
other than his own feelings to support the different 
levels of classification. 

INFORMATION THAT LOST SOME OF 

ITS SENSITIVITY WAS NOT DOWNGRADED 


The classification level of portions of 16 documents 
could have been reduced or eliminated because the para- 
phrasing or summarizing of information in them reduced the 
sensitivity of the information. Information can be deriva- 
tively classified by extracting it verbatim from already 
classified material or by restating, paraphrasing, or sum- 
marizing it from material already classified. Misclassi- 
fication occurs when (1) the information extracted is not 
that which made the source paragraph or page classified or 
(2) the paraphrasing or summarizing reduces or removes the 
source material's sensitivity and basis for classification. 

The new order states that individuals applying deriva- 
tive markings are responsible for verifying the information's 
current level of classification as far as practicable before 
classifying it. They are required to (1) determine if their 
restating, paraphrasing, or summarizing has removed the basis 
for classification and (2) classify the document at a lower 
level, or not at all, when verification with the originator 
or other appropriate inquiry indicates that a lower level of 
classification is warranted or that the information should 
be unclassified. Discussions with individuals who applied 
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derivative markings and a review of the information they 
classified, indicated that they were not aware of their 
responsibility. For example: 

— Three documents were classified secret because they 
had been summarized from secret documents, even 
though the information had lost much of its sensi- 
tivity. The classifiers agreed that the information 
was less sensitive, but believed that it was their 
duty to observe the classification levels of source 
documents. 

— In two other instances, classifiers extracted in- 
formation from source paragraphs marked secret. The 
classifiers agreed that the information extracted was 
probably confidential or unclassified, but believed 
that they were required to follow the classification 
of source material regardless of their own judgment. 

No one verified whether the information extracted 
still had to be classified. 

WHEN THERE WAS DOUBT ABOUT 
THE LEVEL OF CLA SSIFICATION, 

A HIGHER CLASSIFICATION 
LEVEL WAS ASSIGNED 

The new order (as did its predecessor) requires that if 
there is reasonable doubt as to which level to classify in 
formation or whether even to classify the information, the 
less restrictive classification should be used, or the inror 
mation should not be classified. 

Discussions with classifiers and a review of information 
that they had classified indicated that this requirement was 
not always followed. Several classifiers told us that when 
source material or classification guidance was not clear and 
they were in doubt as how to classify, they tended to clas- 
sify at a higher level because the penalties for underclas- 
sifyinq far outweighed those for overclassifying. Discus 
sions with other classifiers indicated that the informal rule 
of thumb followed was, when in doubt, classify the informa- 
tion at the secret level. The classifiers felt that the 
confidential level did not provide sufficient protection to 
the information and that the controls on top secret material 
made the information too restrictive to deal with. We iden- 
tified 20 documents that contained one or more examples of 
information classified at a higher level because the clas- 
sifiers had doubts about the level of classification. 
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—Unclassified information was contained in an August 

1978 message. Similar information contained in a 

September 1978 letter was originally classified 
oepueuiuci. n nt minnr differences 


could 


secret. The classifier pointed out minor 
in the information, but agreed that the letter 
have been classified no higher than conf identi al. 

He said, however^ that when there was a question as 
He said, no J. lassif ica tion, he would rather be 

more restrictive classification. 


to the level 
safe and use 


of 

the 


-One individual classified a port 
containing data on war plans as 
that the letter should have been 
explained that he had doubts as 
damage to national security the 
data would have caused, and that 
of thumb was to classify all war 
less than the secret level when 
guide requiring another classifi 


ion of a document 
secret, but agreed 
confidential. He 
to the potential 
disclosure of the 
an informal rule 
plans data at no 
there is no specific 
cation. 


CONCLUSIONS 

Even thouqh the Executive order and implementing instruc- 
tions clearly describe the types of information that should be 
classified and even specify other types that should not be 
classified, our review indicated that a sizable perce g 
Se information classified was not classified properly^ Im- 
proper classification causes less information^ be made 
available to the public, reduces public confidence in the 
system, weakens protection for truly sensitive information, 
and increases administrative costs. 

We believe that the examples described in . th ^ cl ? ap ^^. 

demonstrate that a serious problem exists /^asslS iniorma- 

individuals who originally or derivatively “ ^ 

tion either are not fully knowledgeable of the requiremen . 

of the order and implementing instructs ions ^J^Tlesser _ 
follow a course of action that would result in a lesser pe 
alty to them if they incorrectly classify information. 

in our opinion, improved training for individuals clas- 
sifying information could reduce the incidence ° ' ,^ p . 

of problems discussed above. Such training should' Wie- 
the importance of the requirements of the order and £ m P 
meriting instructions and the responsibilities of each indi 
vidual who classifies information. 

in addition, we believe that the DOD inspection program 
should direct more attention to evaluating why certarn m or- 

ma?lin U ^asSifted at a particular level or why rt should 
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be classified at all. These inspections, besides identi- 

claslifiers P J r o Cla f SifiCati ° n activit y^ would instill in the 
ssifiers a greater awareness of the need to exerri«sf> 

their^ ^ re ” hen f lassif y lri 9 information to assure that 

SatrucUo^s? * lth the ° rdar a " d ^1—ntin, 

inspect ions°are € included “"cha^? IT™* “ alni "9 a " d 

POD COMMENTS AND OUR EVALUATION 

leve 1 I of C ?r^ nting ? n ° Ur findin 9 that the classification 

becaJse the oaraohr^i C ° Uld haVS b< T en reduced or eliminated 
in them reduced th^fn ? 9 or summarize ing of the information 
that i? tbe information's sensitivity, dod states 

an sich clafs?M^t raCt i Cable f ° r individ ^ls to verify 

counterproductive?^* 0 " CaUSe SUCh procedures «°uid be 
We recognize that the Executive order calls for norifi 

a Si, 1 ty ^ .Since the previous Executive order contained 
divid^rto r ° V1 -e° n .K 0nCerning the responsibility of ! 

belisvS t^at thif y f ■ a- Cla ??j £icatlon level whe " « doubt we 
training^and education!" 9 lllustrat « «» ».ed for improved 
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CHAPTER 4 


CONTINUING DEFICIENCIES IN MARKI NG 
; C LASSIFIED INFORMATION 

The Executive order and implementing instructions clearly 
specify the markings that are to be shown on each classified 
document. However, of the 556 documents reviewed, 184, or 
about 33 percent, were improperly marked in one or more ways. 

We believe that the incidence of such errors is high, inasmuch 
as similar markings were required under the previous order and 
implementing instructions that were in effect from June 1972 
through November 1978. 

The improper marking of classified information has been 
a continuing problem for DOD. Even though all components in 
DOD did not compile and report statistics on improperly marked 
documents as required under Executive Order 11652, DOD re- 
ported about 7,200 such errors in 1977. The report does not 
indicate how many documents were examined. 

At one location visited in March and April 1979, we 
reviewed five reports of inspections made from October 1976 
through October 1978. The marking deficiencies noted during 
those inspections were similar to those noted during our re- 
view. Based' on the results of our review, there did not appear 
to be any significant' improvement in the marking process. We 
identified 31 marking errors on 23 of 31 documents. 

Proper marking of classified information is required to 
provide adequate protection. Properly marked information 
should preclude its unauthorized or premature disclosure and 
assure that it is promptly reviewed, downgraded, or declas- 
sified. At the time of original classification, documents 
are required to be clearly marked to indicate 

— the identity of the original classification authority 
and the office of origin, 

— the date or event for declassification or review or 
the reason the information is to remain classified 
for more than 6 years, and 

— the portions of the documents that are classified, 
with the applicable classification level, and the 
unclassified portions. 

Derivatively classified documents are required to be similarly 
marked. Noncompliance with these requirements is discussed 
below. 
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The following are examples of the marking stamps required 
by the new order for (1) original classification not in excess 
of 6 years, (2) original classification in excess of 6 years 
but not in excess of 20 years, and (3) derivative classifica- 
tion using a guide dated March 1, 1979. The information in 
the following examples is fictitious, but we have assumed a 
classification date of June 28, 1979. 

Example 1: Classified by Director, Defense Intelligence 
Agency 

Declassify on 28 Ju ne 19 85 


Example 2: Classified by Cdr. , 314th Air Division 
Review on 28 June 1989 

Extended by Commander in Chief, Pacific Air Force 
Reason DOD 5200.1, 2 -301 . 6 . 7 

Example 3: Classified by Naval Sea Systems Command 
Instruction C5511.5 
Declassify on 1 March 1985 

IDENTITY OF ORIGINAL CLASSIFICATION 
AUTH ORITY AN D OFFICE OF OR I G IN NOT S H OWN 

Classified documents are marked on the face to show 
the original classification authority and the office of 
origin so that questions or challenges regarding the infor- 
mation classified can be directed to the proper sources. 

The original classification authority or the office of 
origin was not shown on 55 of the documents that we reviewed. 
For example, a March 1979 secret OSD memorandum did not show 
the classification authority. In addition, it did not con- 
tain instructions as to when it was to be declassified and 
it was not portion marked. 

DATE OR EVENT FOR DECLASSIFICATION 
OR REASON FOR EXTENDED 
CLASSIFICATION NOT SHOWN 

The Executive order requires the classifier to establish 
a date or event for the declassification or review of the in- 
formation at the time it is originally classified. This date 
or event is to be as early as national security permits, in 
most cases no more than 6 years and no more than 20 years 
after original classification. Foreign government informa- 
tion may be classified for up to 30 years. 
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The purpose of specifying a date or event for declas- 
sification or review is to ensure that information is declas- 
sified as soon as possible. Information that remains unnec- 
essarily classified violates the public's right to know, 
imposes unnecessary storage costs, and weakens protection 
for truly sensitive information by undermining respect for 
all classification. 

Also, at the time of original classification, documents 
containing information classified for more than 6 years are 
required to be annotated on the face of the document with 
the reason classification is expected to remain so that any 
questions regarding the rationale for the prolonged classifi- 
cation are readily explained. 

The 1 date or event for declassification or review or the 
reason for extending classification for more than 6 years was 
not shown or incorrectly shown on 55 documents. 

PORTION MARKING 

According to the order, to facilitate excerpting and 
other uses, each classified document shall, by marking or 
other means, indicate clearly which portions are classified, 
with the applicable classification designation, and which 
portions are not classified. DOD|s information security 
regulation is even more specific in this regard. It states 
that each section, part, paragraph, subparagraph, or similar 
portion of a classified document shall be marked to show the 
level of classification of the information contained in or 
revealed by it or that it is unclassified. Portions of 
documents are required to be marked in a manner that elimi- 
nates doubt as to which of its portions contains or reveals 
classified information. 

Classified portions n ot 
clearly marked 

Of the 556 documents, 118, or 21 percent, were not clearly 
marked to indicate the portions that were classified. 

A 50 line paragraph marked secret contained four sub- 
paragraphs and covered several pages; however, only three 
sentences covering eight lines contained classified inforroa 
tion. The other 42 lines contained unclassified information. 
Nevertheless, because the document was not properly portion 
marked, any of the information on the other 42 lines extracted 
by someone other than the original classifier would have to be 
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classified as secret, unless that individual (the derivative 
classifier) challenged the marking. Thus, information that 
could be unclassified could remain classified for 6 years or 
longer. 

Portion marking for informatio n 
classified for more than 6 ye a r s 

While the order requires that classified documents be 
portion marked to show the level of classification, it does 
not require that they be portion marked to identify that 
part of the information that has to remain classified for 
more than 6 years. Consequently, classified information 
that might be declassified sooner, could remain classified 
as long as the entire document is classified. In addition, 
if classified documents are subsequently reviewed for de- 
classification, the review process could be facilitated if 
the documents are marked to identify those portions that re- 
quired classification for an extended period. Such marking 
would also facilitate responses to requests made in connec- 
tion with the Freedom of Information Act. 

This potential problem with portion marking takes on 
added significance because most classified documents are 
classified for more than 6 years. As noted on page 7, 

60 percent of the documents that had a date for declassifi- 
cation or review, were classified for more than 6 years. 

One document we identified that illustrates the need 
for such portion marking was the Office of the Secretary of 
Defense's Consolidated Guidance. It contained hundreds 
of pages and provided guidance to all DOD components con- 
cerning DOD programs for a 5-year period. According to one 
official, the Consolidated Guidance for fiscal years 1981-85 
was classified for 20 years primarily because it contained 
intelligence data. It was that official's opinion that much 
of the information in the volume should not have been classi- 
fied for that long. However, the entire volume was marked 
classified for 20 years and, since the information in it that 
required extended protection was not specifically marked, any 
of its nonintelligence information derivatively classified by 
a countless number of individuals in the various DOD com- 
ponents will probably have to remain classified for 20 years. 

C ONCL US IONS 

DOD has not been able to correct continuing document 
marking problems. Marking deficiencies noted during our 
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April 1979 review were similar to those found during DOD's 
inspections since October 1976. 


Marking problems included incomplete or incorrect infor- 
mation stamped on the face of documents and information not 
adequately portion marked to clearly identify its classifi- 
cation level. 

A marking stamp that does not identify who or what 
office originated the classified information makes it dif- 
ficult to question or challenge a classification decision 
if the need should arise. A missing date or event for 
declassification or review can unnecessarily prolong the 
classification of information. If the reason information 
is classified for more than 6 years is not clearly displayed 
on the face of the document, the user and subsequently the 
reviewer will not have a clear understanding of why that 
information requires extended protection. 

Further, . information that is not adequately portion 
marked to indicate its classification level can cause unnec- 
essary classification, especially if that information is 
extracted by someone other than the original classifier, 
since it is difficult to determine if unclassified material 
is being extracted from a classified document unless each 
section clearly specifies which portions are classified and 
which are not. 

In our opinion, improved training of individuals who 
apply classification markings could reduce the number of 
marking deficiencies. Our recommendation concerning improved 
training is included in chapter 5. 

Neither the Executive order nor the implementing in- 
structions require portion marking to identify specific 
portions requiring extended protection to information clas- 
sified longer than 6 years. The marking on the face of the 
document only indicates that the entire document requires 
extended protection. Consequently, information in the docu- 
ment not requiring protection for longer than 6 years could 
remain classified as long as the entire document is classi- 
fied. We believe that DOD should require portion marking 
that identifies the specific information that requires 
extended protection, especially since DOD is responsible 
for over 90 percent of the information being classified in 
Government. However, we recognize that in order to be fully 
effective, such a recommendation would require Government-wide 
implementation. 
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RECOMMENDATION 

We recommend that the Secretary of Defense revise the 
DOD information security program regulation to require that 
classified documents be portion marked to identify the 
specific information in them that requires protection for 
more than 6 years. 

D0D C OMMENTS AND OUR EVALUATION 

While DOD supports the goal of making more information 
available to the public, it believes that implementation of 
the above recommendation would require a major and costly 
program for the periodic review of all documents to identify, 
separate, reproduce, and provide to the public those portions 
of classified documents no longer requiring protection. DOD 
further believes that because of the exchange of classified 
information among several Federal agencies, the recommenda- 
tion — even if it was deemed desirable — could not work well 
in DOD unless it was implemented throughout the executive 
branch. 

It appears that DOD has misinterpreted our finding and 
recommendation. We are not advocating a special periodic 
review of classified documents to identify parts thereof 
that can be declassified sooner than other information in 
the documents. Our recommendation was primarily directed 
to derivative classification situations s$uch as the example 
of the Consolidated Guidance. That is, information not 
requiring extended classification, that is derivatively 
classified from originally classified documents, could be 
identified and so marked and, presumably, declassified at 
a date earlier than would otherwise be the case. Because 
of the large volume of information that is derivatively 
classified in this manner and the fact that most documents 
are classified for more than 6 years, we believe that our 
recommendation has merit. Although we agree that the rec 
ommendation could not be fully effective without Government 
wide implementation, we believe that implementation within 
DOD would be a good place to start, since DOD accounts 
for over 90 percent of the information classified by the 
Government . 
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CHAPTER 5 

IMPROVED TRAINING AND INSPECTIONS NEEDED 

As noted in the preceding chapters of this report, 
serious classification deficiencies persist in DOD. We 
believe that these deficiencies have continued because 
(1) individuals who classify information have not had ade- 
quate training and (2) formal inspections have not directed 
sufficient attention to the question of whether information 
has been properly classified. 

INADEQUATE TRAINING OF INDIVIDUALS 
WHO CLASSIFY INFORMATION 


While most of the installations and offices visited had 
some type of information security education and training 
program, our discussions with individuals who classify infor- 
mation indicated that such training did not always entail 
instructions on what information to classify and what clas- 
sification level to assign. Further, this type of training, 
when provided, is usually directed to security managers and 
supervisors who are responsible for developing and imple- 
menting security education programs for those who actually 
classify information within their respective groups. We 
believe that not providing such training directly to those 
who classify information was a major cause of many of the 
classification deficiencies we identified. 

Both Executive orders have required agencies to establish 
training and orientation programs to familiarize employees 
concerned with classified information with the provisions of 
the orders and implementing instructions. The DOD informa- 
tion security program regulation requires the heads of DOD 
components to establish security education programs. Accord- 
ing to the regulations, such programs "shall stress the 
objectives of classifying less information, declassifying 
more, and improving protection of information that requires 
it." The program, as a minimum, should be designed to indoc- 
trinate personnel in the principles, criteria, and procedures 
for the classification, downgrading, declassification, 
marking, and dissemination of information, as prescribed by 
the DOD regulation. 

In 1974 DOD began offering an information security 
management course at its Defense Industrial Security Insti- 
tute in Richmond, Virginia. DOD officials said that the 
course is the most comprehensive one given in the classifi- 
cation area. It is a 2-week course — 1 week focuses on the 
proper classification of information and the other week 
covers the physical protection of the information. The 
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first week addresses the questions of what information to 
classify, what classification level to assign, and when to 
downgrade or declassify. In addition to the 2-week course, 
the Institute offers a condensed 3-day version of the course 
which is given at the installations that request it. 

This course is primarily designed fpr security managers 
and other DOD personnel responsible for administering DOD's 
information security program — to help them develop and imple- 
ment education and training activities for individuals m 
their organizations who actually classify information. 

Through June 1979, the Institute had conducted 43 2-week 
courses and 45 3-day courses. About 1,900 individuals at 
tended the 2-week courses and about 3,400 participated m 
the 3-day courses. 

In addition to this course the Navy provides its secu- 
rity managers with a security handbook to be used as guidance 
for developing security education programs for its classi 
filers* The Navy also has a slide presentation and briefing 
material which instructs classifiers on what information to 
classify and at what level. 

Army and Air Force officials, however, told us that a 
comprehensive training program concerning what information 
to classify, and at what level, does not: exist within their 
departments . 

Also, most of the classifiers told us that the security 
information training and education that :they had received 
generally did not address the actual classification of infor- 
mation. This training generally consisted of orientation 
briefings for newly hired or transferred staff; periodic 
security briefings; and memorandums, newsletters, posters, 
and other security-awareness-type publications. Most of the 
training concerned the proper marking and safeguarding of in- 
formation, rather than its proper classification. 

At one location we were told that several of the defi- 
ciencies that we had identified and brought to the attention 
of local officials would be discussed ip future education 
efforts . 

INSUFFICIENT INSPECTIONS OF_THE 
PROPE R CLASSIFIC ATION' OF IN FORMATION 

Although self-inspections, group or command inspections, 
and inspector general inspections had been made at each loca- 
tion that we visited, these inspections seldom, if ever. 
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included an evaluation of whether information had been prop- 
erly classified. These inspections generally focused on the 
proper safeguarding of documents, other physical security 
responsibilities, and proper markings. 

Most classifiers indicated that our review was the first 
time that they had ever been asked by an independent party 
to justify their classification decisions. 

The Executive order requires each agency originating or 
handling classified information to designate a senior offi- 
cial to conduct an active oversight program to ensure effec- 
tive implementation of the order. The previous order con- 
tained a similar requirement. The implementing instructions 
issued for both orders make no additional reference to this 
requirement. 

DOD's information security program regulation provides 
that the head of each military department and component 
designate a senior official who will be 1 responsible f or 
compliance with and implementation of the DOD _ regulation. 

The regulation further provides that such senior officials, 
within 9 their respective jurisdictions, will b © responsible 
for monitoring, inspecting, and reporting on the status of 
administration of the program at all ievels of activity 
under their cognizance. There is no requirement or guidance 
concerning the frequency or the types of inspections that 
are to be made. 

Some groups told us that the day-to-day administrative 
review that a document receives as it goes through the deci- 
sionmaking hierarchy would identify any weaknesses in the 
classification process; however, based upon the 
errors that we found during our review, it is doubtful that 
informal, routine reviews of documents eliminate the need 
for formal, comprehensive inspections for the proper clas- 
sification of information. 

Some individuals also told us that challenges to clas- 
sification decisions would detect and correct weaknesses in 
the system, but our discussions with classifiers indicated 
that formal challenges were rarely, if ever, made. Most 
classifiers assumed that whoever originally classified the 
information did so correctly. Several classifiers told us 
that sometimes they would challenge a classification deci 
sion if the classification appeared to limit distribution 
or seriously inhibit working with the document. 
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While the challenging process could be beneficial to the 
program if fully implemented, it should not be considered a 
substitute for formal inspections that review classification 
decisions. Most security managers and classifiers told us 
that they believed that more formal and comprehensive inspec- 
tions would be helpful to the program. Officials from one 
organization told us that inspections that covered classifi- 
cation decisions were needed and would be instituted at that 
organization. 

CONCLUSIONS 


We believe that DOD's information security training 
program should direct more attention to the individuals' who 
actually classify information. Such training should include 
detailed instructions on who can classify national security 
information and how to properly classify and mark it. 


Additional training should contribute to a reduction in 
improper use of classification authority, improper classifi- 
cation of information, and improper marking. 

While the areas covered by the various DOD inspections — 
physical safeguards and markings — are important, we believe 
that the propriety of the classification decisions is equally 
important. These inspections, as a minimum, should include 
a determination of whether information should be classified 
and, if classified, whether it is classified at the proper 
1 G V0 JL > 

RECOMMENDATIONS 


We recommend that the Secretary of Defense revise the 
information security program regulation to provide for ex- 
panded training for individuals who classify information, 
originally or on a derivative basis, and that such training 
among other things, should concentrate on 

the responsibility of all individuals to comply with 
the Executive order and implementing instructions, 

who can classify national security information, 

— what information is to be classified, and 

how to properly classify and mark such information. 

We further recommend that the Secretary of Defense re- 
information security program regulation to provide 
definitive guidance on the frequency of the different levels 
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of inspections that should be made and the items to be 
covered by such inspections, with special reference to the 
need for inspections to question the propriety of classif 
cation decisions. 


DOD COMMENTS AND OUR EVALUATIO N 


nnn hpl ipves that the discrepancies noted and presented 
in thK report "do nSt cSnvey no/support a premise of noncom- 
pliance with the requirements of Executive Order 1 * 

that thev do underscore the continuing need for senior level 
awareness of the program and management support or ^ 
and traininq efforts. As indicated by our recommendation, 
there is a need for more education and training. Moreover, 
that recommendation was based upon a large number of examples 
Of noncSmp^ance with the Executive order and impiementing 
regulations and instructions. 

DOD further believes that the errors identified "were 
generally^minor in foujd in aoc™ n 

lif-c rred‘ Ic s °m /Kdl^dS^rwere still unfamiliar 

“"th the nJw security clLsif ication system We believe 

“miLr°in i Ltu?^" eC For n instInce" Z 24 q pe?Sent of the documents 
we reviewed contained one or more examples of * 

sification of national security information. I n ou 0 P inl ° ' 
examples such as these could hardly be considered minor. We 
nicio hPlieve that DOD's assertion that the errors were l - c * u 
Sy unfamiliarity with the new order because most 

A a. h _ nrovisions of the new order— with which deficiencies 
are identified in this report— are identical or i^effect 0 
provisions of the previous order which had been 

since 1972. 

DOD believes that the provisions of the 
.p^ritv program regulation pertaining to training are 
edeouate but that it is considering ways to improve its 

“already'good security ^^“^^"Ip^rinus- 

t?ate 1 the e need t fo!T implement in those programs and that 
including ce?tain basic points, for such Programs in the 
regulation would direct attention to them. We furt 
hp ? i pue that the establishment of minimum training stan 
dards that would increase the number of individuals who 
receive such training is vital if DOD is to improve im- 
plementation of its classification program. 


29 

Approved For Release 2002/01/24 : CIA-RDP85B00236R0002001 3001 4-4 



Approved For Release 2002/01/24 : CIA-RDP85B00236R0002001 3001 4-4 


With respect to our recommendation concerning the 
frequency and types of inspections to be made, DOD states 
that our use of the term "different levels of inspections" 
is unclear and that the necessity for inspections is basi- 
cally a command function and will vary greatly between 
units. Nevertheless, DOD says that it will consider the 
basic concept of our recommendation— to provide guidance 
on the minimum frequency of security inspections and areas 

the b diff Vere h’i A1 ! :hough our recommendation did not specify 
paae H fif of inspections, they are identified on 

page 2 6 as self-inspections, group or command inspections, 
and inspector general inspections. 
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POLICY 


THE UNDER SECRETARY OF DEFENSE 

WASHINGTON, D.C. 20301 


5 OCT 1979 
In reply refer to: 
1-09445/79 


Mr. R. W. Gutmann 

Director, Logistics and Communications Division 
United States General Accounting Office 
Washington, D.C. 20548 

Dear Mr. Gutmann: 

This is in response to your draft Report to the Congress (OSD Case 
No. 5268) (Code 941180), "Continuing Problems in DoD's Classifi- 
cation of National Security Information" that was forwarded to the 
Secretary of Defense by your letter of August 27, 1979 wherein you 
invited comments regarding the draft Report. 

The discrepancies noted and as presented in the draft Report do not 
convey nor support a premise of noncompliance with the require- 
ments of Executive Order 12065, "National Security Information. " 
They do underscore the continuing need for senior level awareness 
of the Information Security Program and management support for 
education and training efforts. 

The Department’s views concerning the draft Report are set out in 
the attachment. 


Attachment 


Sincerely, 


j/C'\Daniel J. Murphy 
^ Admiral, USN (Ret. ) 
Deputy 
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DEPARTMENT OF DEFENSE COMMENTS 
CONCERNING UNITED STATES GENERAL ACCOUNTING OFFICE 
DRAFT REPORT TO THE CONGRESS DATED AUG. 27, 1979 
(OSD CASE NO. 5268) (CODE 941180) 


The third full paragraph on page 3 of the draft Report indicates that 
49 percent of the 556 classified documents reviewed by the GAO were 
found to have at least one of many possible errors. A review of the 
report indicates those errors were generally minor in nature and 
found m documents classified within a half year or so of the effective 
date of Executive Order 12065, a period of time during which the Order's 
new security classification system was still unfamiliar to many people. 
As experience with the new system is gained, it is expected that the 
error rate will diminish. 


The second paragraph on page 4 of the draft Report indicates the GAO 
review of classified documents was hampered by the refusal of the 
Office of the Joint Chiefs of Staff (OJCS) and the Air Force to make 
certain documents available. The documents requested in the OJCS 
instance were Joint Strategic Planning System (JSPSj documents. In 
response to the request, the GAO team leader was informed, by 
memorandum, that access to such documents is severely limited 
because of their sensitivity and that the GAO requirement for such 
documents for the purpose of conducting a security classification review 
was not evident. The documents that had been requested at the Air 
Force were originated by the JCS and Defense Intelligence Agency or 
m res P° nse to those organizations. The distribution limitations 
reflected in the documents were imposed by those organizations to pre- 
clude release by other than the JCS or DIA. It is our view that the 
effectiveness of the GAO survey was not diminished by these restrictions 
his is evidenced by the conclusions and recommendations in the draft 
report which were based on inspections of a wide variety of other 
classified material. 


On pages 6 and 7 of the draft there is a discussion of an incident 
involving the unauthorized use of the position title of an original Top 
ecret classification authority by personnel of a command who were 

WeU 1Ze T d K t0 , 0ri ,! inally ClaSSify information ^ the Secret or Confidential 
levels ^ The draft points out that the memorandum granting that 

authority was rescinded and replaced by a security classification guide 

that only sets the minimum level of classification and the maximum 

uration of classification for the categories of information identified 

by the guide. The Department's Director of Information Security has 

since requested (by memorandum of 13 July 1979) that a number of 

changes to the guide be made to overcome its weaknesses. 


Approved For Release 200210^4 : CIA-RDP85B00236R0002001 3001 4-4 



* JteAt°Y.ed For Release 2002/01/24 : CIA-RDP85B00236R0002001 3001 4-4 
APPErfm I APPENDIX I 

The paragraph that begins on page 7 and continues on page 8 of the 
draft Report indicates that a DoD organization specified in writing 17 
items of information that should be classified longer than six years. 
Presuming that the correspondence was approved by the commanding 
officer of the organization, the only person with original Top Secret 
classification authority in the organization, and that the list 
identified specific items of information to be classified for stated 
periods of time in excess of six years, the correspondence was in 
effect a security classification guide within the meaning of the Executive 
Order, 

On page 10 of the draft there is a RECOMMENDATION "that the 
Secretary of Defense revise the information security program regulation 
to require that all classification guides and revisions thereto be re- 
viewed by an official other than the originators of the guides, to assure 
compliance with the provisions and intent of the executive order and 
the DoD regulation. We further recommend that deviations from the 
requirements of the executive order or the regulation, noted during 
these independent reviews, be brought to the attention of the Director 
of Information Security to assure their prompt resolution. " 

It is understood that the foregoing recommendation is undergoing minor 
revision. In any event, review of classification guides by other than the 
originator is already common practice within the Department though not 
specifically required as such by the Regulation. With modification, the 
Department will consider the second part of the recommendation. 
Referral of deviations from the Order and Regulation to the Director of 
Information Security would be appropriate only in those cases of un- 
resolved problems within or between DoD Components. 

The second paragraph on page 15 of the draft Report contains a statement 
to the effect that "the classification level of 16 documents could have 
been reduced or eliminated because the paraphrasing or summarizing 
of information in them reduced the sensitivity of the information. " 

An individual using source documents from other agencies must respect 
the original classification determination of those agencies. If in doubt, 
and when it is possible, that individual should verify the classification, 
but one cannot practically verify every classification decision or submit 
every paraphrase to the originating agency for a classification deter- 
mination. Such procedures would prove counterproductive. 

There is a RECOMMENDATION on page 24 of the draft that states "We 
recommend that the Secretary of Defense revise the DoD information 
security program regulation to require that classified documents be 
portion marked to identify the specific information in them that requires 
protection for more than 6 years. " 
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The Department of Defense must nonconcur with the foregoing recommen- 
dation. The draft Report indicates that such markings as recommended 
would make more information available to the public at an earlier date. 
The Department supports the goal of making more information available 
sooner, but to be effective in this context, the GAO recommendation 
would require a major and costly program for the periodic review of all 
documents to identify, separate, reproduce, and provide to the public 
those portions of classified documents no longer requiring protection 
in the interests of national security. The product of such an effort 
would be a disjointed accumulation of bits of the whole story on a given 
subject that would be of little value to the public and may even be mis- 
ieadmg. Further, the recommended marking scheme may not actually 
facilitate reviews for declassification such as those done under the 
Freedom of Information Act. Such a review for declassification must 
be based on a reevaluation of the continuing sensitivity of the information. 
Marking portions with a duration of classification might lead to an 
unacceptable "automatic" review where the reviewer might tend to 
accept as still valid the original classifier's judgment as to which 
portions of a document require extended classification. As the draft 
notes, this recommendation goes beyond the requirements of the 
Executive Order and its implementers. It could not work well in this 
Department alone even if it was deemed to be desirable. Executive 
Branch-wide implementation of the recommendation would be required 
due to the exchange of classified information among the several 
departments and agencies. 


On page 28 of the draft there is a RECOMMENDATION that "the 
Secretary of Defense revise the information security program regulation 
to provide for expanded training for individuals who classify information, 
originally or on a derivative basis, and that such training, among other * 
things should concentrate on 


the responsibility of ail individuals to comply with the executive 
order and implementing instructions, 

who can classify national security information, 

-- what information is to be classified, and 

how to properly classify and mark such information. " 

The Department is considering ways to improve its already good security 
education and training programs. That action would be ongoing even in 
the absence of the foregoing recommendation that is based on a review 
of a very small sample of classified documents - half of which had minor 
errors. It is believed that the provisions of the Regulation are adequate. 
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There is a second RECOMMENDATION on page 28 of the draft stating 
that "We further recommend that the Secretary of Defense revise the 
information security program regulation to provide definite guidance 
on the frequency of the different levels of inspection that should be made 
and the items to be covered by such inspections, with special reference 
to the need for inspections to question the propriety of classification 
decisions. " 


With respect to the foregoing, the use of the term "different levels of 
inspection" is unclear. It should be recognized that inspection for 
compliance with DoD or Component requirements of all kinds is basically 
a function of command and that the necessity for inspection for compliance 
with the Information Security Program Regulation will vary greatly 
between units or elements at the same level of subordination. 
Notwithstanding, the Department will consider the basic concept of the 
recommendation, i. e. , to provide guidance on the minimum frequency 
of security inspections and areas to be covered. 


GAO Note: Page references in this appendix have been changed to agree 
with the page numbers in the final report. 


(941180) 
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